<!DOCTYPE doc [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]> <w:p><w:r><w:t>&xxe;</w:t></w:r></w:p> Always disable external entities and DTDs in your XML parser.
When reading any ZIP part, normalize the entry name and reject any containing .. or absolute paths. 5. Reference Implementation: A Secure Streaming Downloader We present a pseudo-code implementation for a REST endpoint that generates a simple .docx report from JSON data, using streaming and security best practices. 5.1 System Architecture [JSON Input] -> [Streaming XML Writer] -> [In-memory ZIP stream] -> [HTTP Response] ^ | | (direct write) v [Content Types & Relationships] [File Download] 5.2 Core Implementation (C#/.NET Core Example) [HttpGet("report.docx")] public IActionResult GenerateDocx(string title, string content) office open xml download
var stream = new MemoryStream(); using (var archive = new ZipArchive(stream, ZipArchiveMode.Create, true)) // 1. [Content_Types].xml var ctEntry = archive.CreateEntry("[Content_Types].xml"); using (var ctWriter = new StreamWriter(ctEntry.Open())) ctWriter.Write(@"<?xml version='1.0' encoding='UTF-8'?> <Types xmlns='http://schemas.openxmlformats.org/package/2006/content-types'> <Default Extension='rels' ContentType='application/vnd.openxmlformats-package.relationships+xml'/> <Default Extension='xml' ContentType='application/xml'/> <Override PartName='/word/document.xml' ContentType='application/vnd.openxmlformats-officedocument.wordprocessingml.document.main+xml'/> </Types>"); // 2. Relationships (.rels) var relsEntry = archive.CreateEntry("_rels/.rels"); using (var relsWriter = new StreamWriter(relsEntry.Open())) relsWriter.Write(@"<?xml version='1.0'?> <Relationships xmlns='http://schemas.openxmlformats.org/package/2006/relationships'> <Relationship Id='rId1' Type='http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument' Target='word/document.xml'/> </Relationships>"); [Content_Types]